The question was asked how Drone clones a repository. I wanted to document this in Discourse so that others could benefit from the answer (and ask follow-up questions). A common misconception is that the agent clones the repository, or that the repository is cloned inside the agent container, which is not the case.

Drone adds a default clone step to every Pipeline. The clone steps executes the clone plugin, which is pretty much just a vanilla Drone plugin that handles cloning the repository. You can find the plugin here.

The username and password vary based on your source code management system. If your source code management system is github, for example, the password is x-oauth-basic and the username is the oauth token.

There are two caveats to this behavior:

the credentials are only passed to the plugin if the repository is private or DRONE_GIT_ALWAYS_AUTH=true

if you set DRONE_GIT_USERNAME and DRONE_GIT_PASSWORD, these values are used as the username and password